Services · CFO & advisory
Internal controls
Controls designed around how your business actually runs, documented in the form auditors, regulators and boards expect, and tested to show they operate.
Controls that fit the business
Weak controls rarely announce themselves. The first sign is usually a payment that should not have been made, a stock count that does not agree, or a page of findings in your auditors' management letter. By then the damage has been done.
We start from how transactions really move through your business, identify where things can go wrong, and design controls in proportion to the risk and to the size of your team. Then we document them, test them and help you put right what does not work. A partner reviews every finding before it reaches you.
What we deliver
Each element can be taken on its own or combined into a full review of your control environment.
Process walkthroughs
We follow transactions from start to finish through purchasing and payments, sales and collections, payroll, inventory, treasury and the month-end close, recording who does what, in which system, and where each control sits.
Risk and control matrices
For each process, the risks that matter, the control that addresses each one, its owner, how often it operates, whether it prevents or detects, and the evidence it leaves.
Segregation of duties
An analysis of who can do what, including user access in your accounting system, to find conflicts such as one person setting up suppliers and approving payments to them.
Approval matrices and delegation of authority
Written limits on who can commit, approve and pay, covering spending, contracts, journals, payroll changes, write-offs and new bank accounts, with the matters reserved to the board.
Design and testing of controls
Controls designed to close the gaps, then tested in two ways: for design, to confirm each would address its risk, and for operating effectiveness, to confirm it worked throughout the period.
Fraud risk reviews
An assessment of where fraud could occur, from fictitious suppliers and duplicate payments to payroll and expense claims, and whether your controls would prevent or detect it.
Policies, procedures and governance
Standard operating procedures, a finance manual and governance arrangements, from committee terms of reference to board reporting, written with the expectations of auditors, regulators and directors in mind.
When to review your controls
Usually after something has changed, or after something has gone wrong.
- Your auditors have raised control points in their management letter
- The business has grown beyond the point where the owner can approve everything personally
- You are preparing for investment, a new lender or a sale
- A parent company, donor or regulator requires documented controls
- You have had a loss, a near miss or a difference nobody can explain
Our approach
Four stages, scaled to the processes and locations in scope.
Understand
Interviews and walkthroughs of each process, including the systems and reports it relies on.
Assess
Risks and existing controls mapped in a matrix, with gaps and segregation conflicts identified.
Design
Controls, approval limits and procedures agreed with the people who will operate them.
Test and remediate
Controls tested, findings reported, and a remediation plan with owners and target dates.
Deliverables
- Risk and control matrix
- For each process: risks, controls, owners, frequency and evidence
- Gap report
- Weaknesses ranked by risk, with the reasoning behind each
- Remediation plan
- Actions, owners and target dates, agreed with management
- Framework
- Controls mapped to the COSO internal control framework where required
If the concern is the accuracy of the books rather than the controls around them, start with an accounting health check.
Questions
We are a small team. Can we still separate duties?
Often not completely, and that is normal. Where one person has to handle a whole process, we design compensating controls: an owner's review of bank statements and payment runs, independent approval of new suppliers and changes to bank details, and a monthly review of the journals posted.
What is the difference between control design and control testing?
Design asks whether a control, performed as described, would address the risk. Testing asks whether it was actually performed, consistently, throughout the period, which we establish by examining samples of the evidence it leaves.
Will our auditors rely on the controls?
That is their decision, made under their own standards. We document controls in the form auditors work with, make sure each one leaves evidence, and can take your auditors through the matrix. See audit support.
Can our accounting software enforce the controls?
Often, yes. Depending on your system and subscription, user roles, approval steps and period locks can be configured, whether you use QuickBooks Online, Xero or Zoho Books, or an ERP such as Odoo or SAP Business One, so that the software enforces the approval matrix. See software consulting and setup.
Speak with a partner
Every enquiry is read by a partner and answered within one business day. Meetings are held at our offices, at yours, or by video.